from karldns.security import (
    DashboardUnlockIdentity,
    _dashboard_unlock_cookie_parts,
    _strip_header_ip,
    _trusted_proxy_candidate,
)


def test_dashboard_unlock_identity_payload_is_stable() -> None:
    identity = DashboardUnlockIdentity("home.example.net", "manage-secret", "hash")

    assert identity.payload(123, 3600) == b"home.example.net\x00manage-secret\x00hash\x00123\x003600"


def test_trusted_proxy_candidate_matches_cidr_and_single_ip() -> None:
    assert _trusted_proxy_candidate("10.10.0.1", "10.0.0.0/8") is True
    assert _trusted_proxy_candidate("203.0.113.10", "203.0.113.10") is True


def test_trusted_proxy_candidate_ignores_invalid_values() -> None:
    assert _trusted_proxy_candidate("not-an-ip", "10.0.0.0/8") is False
    assert _trusted_proxy_candidate("10.10.0.1", "not-a-network") is False


def test_dashboard_unlock_cookie_parts_parse_v3_cookie() -> None:
    parts = _dashboard_unlock_cookie_parts("v3:123:3600:signature")

    assert parts is not None
    assert parts.timestamp == 123
    assert parts.max_age_seconds == 3600
    assert parts.signature == "signature"


def test_dashboard_unlock_cookie_parts_reject_invalid_cookie() -> None:
    assert _dashboard_unlock_cookie_parts("v2:123:3600:signature") is None
    assert _dashboard_unlock_cookie_parts("v3:not-int:3600:signature") is None


def test_strip_header_ip_handles_common_proxy_formats() -> None:
    assert _strip_header_ip('"203.0.113.10"') == "203.0.113.10"
    assert _strip_header_ip("[2001:db8::10]:443") == "2001:db8::10"
    assert _strip_header_ip("203.0.113.10:443") == "203.0.113.10"
    assert _strip_header_ip("unknown") == ""